Display only few sentences and show all with arror...

summerura · ‎07-14-2020

Hi Splunkers,

my search is like that

and it makes table with data and error message.

But error message includes like 50sentences. And I want to show this all sentences in table. But as you can image that table is too long and my dashboard looks like ugly. So i want to show only first 3sentences with arrow or something. Which means when user click arrow show all sentences for error, but before click you can see only 3 sentences.

Can i do this in splunk?

Thanks for help !

bowesmana · ‎07-14-2020

This will give you an example of how you can do this with drilldown from your first panel to a second panel where the full message is displayed.

<dashboard>
  <label>Test2</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd_ui_access
| rex field=uri "\?(?&lt;path&gt;.*)$" 
| eval pos = if(length(path) &gt; 0, length(uri) - length(path), length(uri)) 
| eval more=if(pos&gt;35,1,0), pos=if(more=1,min(pos,35), min(pos,42))
| eval partial_uri=substr(uri,1, pos - 1)
| eval partial_uri=if(more=1,partial_uri." (..more)", partial_uri)
| eval Date=strftime(_time, "%m-%d-%Y %H:%M:%S")
| table Date partial_uri uri</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <fields>["Date","partial_uri"]</fields>
        <drilldown>
          <set token="uri">$row.uri$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$uri$">
    <panel>
      <html>
        <h1>Full error message details</h1>
        $uri$
      </html>
    </panel>
  </row>
</dashboard>

summerura · ‎07-15-2020

@bowesmana ,

thanks for reply!

     <fields>["Date","partial_uri"]</fields>
        <drilldown>
          <set token="uri">$row.uri$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$uri$">
    <panel>
      <html>
        <h1>Full error message details</h1>
        $uri$

I'm still beginner so i have more questions.

Where can i find url?

and

["Date","partial_uri"] , $uri$, $row.uri$ is all same uri ?

thanks in advance 🙂

bowesmana · ‎07-15-2020

uri is the field in the example search
partial_uri is the field I created that is a shortened form of uri
The <fields> statement is one that restricts the visible fields in the table to only the date and the partial uri
The $row.uri$ is how the clicked drilldown accesses the (non visible) uri field in the table and assigns it to the uri token

Tokens are of the form $name$, so $uri$ is a token called uri and it is assigned the contents of the uri field from the search in the drilldown section of the dashboard when it does the set token statement.

Have a read of this, as it will make things clearer (hopefully :))

https://docs.splunk.com/Documentation/Splunk/8.0.4/Viz/PanelreferenceforSimplifiedXML

Display only few sentences and show all with arrorw when you click

table

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Developer Spotlight with Guilhem Marchand

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

Join the Conversation

Display only few sentences and show all with arrorw when you click

table

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Developer Spotlight with Guilhem Marchand

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...